smmhub
Legal

Privacy Policy

What we collect, why we collect it, where we store it, and your rights — written in plain English. We don't sell your data and we don't run advertising trackers in the dashboard.

Effective January 15, 2026

1. The short version

We are smmhub. We sell engagement campaigns and a developer API. To do that we have to collect a small, well-defined set of personal data — mostly your email, your wallet activity, and the public links you submit with each order.

We don't sell your data, ever. We don't run third-party advertising trackers on the dashboard. We use cookies only for things that genuinely require them (your session and CSRF protection) and your browser's local storage for preferences such as theme and display currency. We run no analytics scripts.

2. Who is the controller

For data submitted through smmhub.io, smmhub Ltd. is the data controller. You can reach our privacy team at privacy@smmhub.io or through /contact.

3. What we collect

We collect the following categories of personal data:

  • Account data — email, hashed password, optional Telegram handle, language preference, time zone.
  • Order data — service IDs, target links, quantities, timestamps, cost in your wallet currency, optional notes.
  • Wallet data — top-up amounts, payment method type (we never store full card numbers — those live with our PCI-DSS-compliant gateway), promo codes redeemed.
  • Technical data — IP address, user agent, language headers, timestamps. Used for fraud prevention and to keep your session secure.
  • Support data — anything you send us in tickets, contact forms, or Telegram.

4. Why we use it

We process the data above to:

  • Provide the Service — deliver orders, charge your wallet, send refill notifications, surface stats.
  • Keep you safe — detect account compromise, block fraud, satisfy AML / KYC requests when payment processors require them.
  • Improve the product — aggregate, non-identifying counts from our own records (orders, tickets, deposits). We run no analytics scripts on the site.
  • Communicate — operational emails (receipts, refill notices, incident updates) and, if you opted in, occasional product news.
  • Comply with law — respond to lawful requests from competent authorities, retain transactional records for the period required by tax law.

6. Who we share it with

We share data only with sub-processors that are necessary to run the Service, under written data-processing agreements:

  • Payment gateway (Cryptomus, for card and crypto top-ups) — only the data it needs to process your payment.
  • Hosting (Hetzner Online GmbH, data centres in the European Union) — the servers and encrypted backups the Service runs on.
  • Email is sent from our own mail servers; support tickets are stored in our own database. Neither is shared with a third-party tool.

7. How long we keep it

Account & order data: while your account is active, plus 12 months after closure for fraud prevention. Tax records (invoices, refunds): 7 years where local law requires it.

Server access logs: 14 days. Support tickets: kept while your account exists and anonymised when the account is deleted.

8. Your rights

Depending on your jurisdiction (GDPR / UK GDPR / CCPA / LGPD / etc.) you may have the right to:

  • Access — get a copy of the personal data we hold about you.
  • Rectification — correct anything inaccurate.
  • Erasure — delete your account and personal data, subject to retention obligations.
  • Portability — export your data in a machine-readable format.
  • Restrict / object — pause certain processing activities.
  • Withdraw consent — opt out of marketing emails at any time.

9. Cookies

Cookies we set: smmhub_session (your login session) and csrf-token (request-forgery protection). Staff who open a customer account for support carry an additional smmhub_imp_session cookie. If you arrive through an affiliate link, smmhub_ref and smmhub_click record that referral for attribution.

Preferences — theme, display currency, date and time format, and your cookie-banner choice — live in your browser's local storage, not in cookies. We set no analytics or advertising cookies.

10. International transfers

Our infrastructure is hosted in the EU. When data crosses borders for a sub-processor (e.g., a US payment gateway), we use Standard Contractual Clauses and additional safeguards required by EU and UK regulators.

11. Security

TLS 1.3 in transit. Backups are encrypted with AES-256 (GPG); the database volume itself is not encrypted at rest. Passwords are hashed with Argon2id. API keys are stored hashed and shown once at creation. Staff access to the admin console requires TOTP two-factor authentication, and every privileged action is written to an audit log.

If we ever experience a breach affecting your data, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of it, as the law requires.

12. Children

The Service is not intended for users under 18. We do not knowingly process personal data of children. If you believe a minor has signed up, contact us and we will remove the account.

13. Updates to this policy

When we change something material we will email account holders at least 14 days before the new policy takes effect. The dated history of this document is available on request.